Electronic access control systems generally restrict access on the basis of (1) possession of a device or object (e.g., a key) which enables access, (2) knowledge of a password, and/or (3) testing a physical attribute of the person requesting access (e.g., the person's fingerprint).
The inherent limitations of access control systems based solely on possession of a physical object (e.g., a key), including insufficient security when large numbers of users are involved, have prompted the development of more secure access control systems.
Systems that allow access based solely on knowledge of a password are the easiest to set up, but are the least secure because passwords can be inadvertently imparted to unauthorized persons. For example, if an authorized person writes down his password, any unauthorized person who obtains access to the written record of the password can pose a permanent threat to the security of the system. Even if the password is changed from time to time, distribution of new passwords requires additional security precautions, all of which are cumbersome and expensive.
Access control systems based on testing of a physical attribute of the user are currently too expensive for use in most commercial applications.
A large number of prior art systems restrict access by using a combination of the first two techniques described above, i.e., by requiring possession of a device and knowledge of a password. For example automatic teller machines (ATMs) restrict access to a person's bank accounts by requiring possession of a card with an encoded magnetic strip, and knowledge of a personal identification number (PIN).
Another example of a security system which restricts assess by requiring a combination of possession of a device and knowledge of a password is a system, called the SAFEWORD System, made and marketed by Enigma Logic, Inc., the assignee of the present invention. The SAFEWORD System provides a much higher level of security than ATMs by requiring the user to know a password (to identify the user) and to possess an electronic key that specifies an encryption algorithm. Possession of the electronic key, in combination with a decoder, enables the user to dynamically generate a password in response to a challenge presented by the computer that the user wants to access.
The computer allows access to its resources only if the dynamically generated password matches an internally generated password. A more complete description of the SAFEWORD system can be found in patent application Ser. No. 370,902, filed Apr. 22, 1982, which is hereby incorporated by reference.